DAS Statewide Policy. SUBJECT: Information Technology Asset Inventory/Management NUMBER: IRM

Transcription

1 DAS Statewide Policy SUBJECT: Information Technology Asset Inventory/Management NUMBER: IRM DIVISION: Information Resources Management Division EFFECTIVE DATE: APPROVED: Signature on File POLICY/ PURPOSE: State law requires the Department of Administrative Services Information Resources Management Division (DAS IRMD) to ensure that all state-owned information technology (IT) assets are inventoried, tracked, and managed throughout each IT asset s lifecycle. Through this policy, and its attachments, DAS IRMD is establishing the baseline standards by which agencies will manage, and collect and report information about the IT Assets under agency control. Agencies will establish IT Asset Management programs and procedures for acquiring, deploying, tracking/managing, and disposing of IT-related assets under its control. Agencies will periodically collect and report a compilation of information about its current IT Assets and its planned IT investments to DAS IRMD following a published state government-wide schedule. Agencies may establish additional written policies, standards, processes and procedures as necessary to accomplish agency business objectives. POLICY CONTEXT: In support of the Governor s priorities relating to government efficiency and effectiveness, the State Enterprise Information Resources Management Strategy and to fulfill state obligations under ORS the Department of Administrative Services (DAS), through the State Chief Information Officer, will review and analyze State government-wide IT Asset Inventory/Management information submitted by each state agency to efficiently and effectively: a. Track and report the state of the state s IT assets on a routine basis b. Provide general guidance to state agencies for managing key asset types including hardware, software, business systems, and data c. Provide specific guidance to state agencies for calculating and reporting on the total cost of ownership of state IT assets throughout the asset life cycle* d. Leverage the state s purchasing power by knowing the state governmentwide need, and the volume and timing of need for future IT hardware and software purchases e. Ensure software license optimization and compliance f. Establish an initial, current and disposal value for the state s IT assets g. Plan for a common, shared, state government-wide information technology infrastructure; and h. Acquire the information needed for state government-wide information resources management decision-making

2 DAS Statewide Policy POLICY NAME: Information Technology Asset POLICY NUMBER: IRM Inventory/Management POLICY CONTEXT (Continued): * The establishment of a common framework for calculating, managing, reporting and reducing the total cost of ownership of IT assets (lifecycle costs) by all state agencies will be established in subsequent revisions to this policy or through a separate policy specifically addressing this Information Resources Management discipline. Additionally, it is expected that other programs designed to leverage the information provided through the implementation of this ITAM policy will be established. AUTHORITY: ORS , , ,477, , , , , , , , , , , Executive Orders: 01-25, 00-02, 99-05, Additionally, the inventory and management of all IT assets are subject to the DAS State Controller s Division (SCD) Oregon Accounting Manual (OAM) Policies and Procedures: , , , , , , ; DAS Risk Management Division - Property Self-Insurance Policy Manual : Section VII Special Plan for Electronic Data Processing (EDP); DAS Risk Management Division Policy Interpretation 1-101: Special Plan for Information Technology (IT) Systems; and, DAS Surplus Computer Equipment Disposal policy APPLICABILITY: All Executive Branch agencies with the exception of the Oregon University System and K-12 education districts. ATTACHMENTS: Attachment 1: Information Technology Asset Management-related Glossary of Terms Attachment 2: Information Technology Asset Inventory Mandatory Attributes Attachment 3: Information Technology Asset Management-Related Architecture and Standards Document Attachment 4: Minimum Information Technology Asset Management Performance Standards) Attachment 5: State government-wide ITAM Inventory Submission Schedule DEFINITIONS: Ancillary Charges means, costs necessary to put a capital asset into use such as freight and handling, insurance in transit, and assembly or installations costs which are capitalized as part of the asset. Capital Assets means, tangible or intangible assets used in agency operations that have initial estimated useful lives beyond a single year and an initial cost (inclusive of ancillary charges) of at least $5,000. (OAM Glossary: RF) Embedded Technology means, microprocessors that are designed into other products and equipment that are not themselves computers. 2

3 DAS Statewide Policy POLICY NAME: Information Technology Asset POLICY NUMBER: IRM Inventory/Management DEFINITIONS (Continued): IT Assets means, all present and future forms of computer hardware, software and related items used for business data processing and office automation which have the ability to connect, either directly or through a Local Area Network (LAN), to the State of Oregon s Wide Area Network (WAN) except devices with embedded technology. IT Asset Inventory means, the process of discovering and verifying information about an organization s information technology asset (e.g. hardware, software, applications, data, etc.) through manual and/or automated means. Non-Capital Assets means, tangible or intangible property used in agency operations having an initial estimated useful life beyond a single fiscal year and having an initial cost (inclusive of ancillary charges) of less than $5,000. (OAM Glossary: RF) Physical Inventory means, physical verification of all items listed on agency inventory records. (OAM Glossary: RF) IT Asset Management Program means, a system of integrated management processes, strategies and technologies that enables an enterprise to manage its assets throughout their lifecycle. Lifecycle means, the series of stages in form and functional activity through which something passes during at least four stages of its lifetime (acquisition, deployment, management/support, disposal/retirement) including budget development and fiscal tracking of these stages. Agency IT Asset Inventory/Management (ITAM) Coordinator means, the agency staff member responsible for the collection, management and reporting of Information Technology Asset Inventory-related information, and agency central point of contact/coordinator with DAS/IRMD in matters relating to IT asset inventory and management. (See Attachment 1: Glossary of Terms for additional definitions) GUIDELINES: I. To fulfill agency responsibility to ensure that the State s IT-related assets are properly procured, accounted for, classified, inventoried, reported, and controlled, the agency head of each agency shall establish an IT Asset Management Program and identify an Agency ITAM Coordinator. 3

4 DAS Statewide Policy POLICY NAME: Information Technology Asset POLICY NUMBER: IRM Inventory/Management GUIDELINES (Continued): II. III. IV. Agencies will develop and submit copies of Agency IT Asset Inventory/Management-related processes/procedures and any additional agency-specific policies beyond this Statewide ITAM Policy to DAS IRMD for review no later than three months following the effective date of this policy. This information will be used to improve statewide IT Asset Management-related policies over time. Agencies will establish standard lifecycles for agency IT assets. Further, Agencies will develop and submit a Lifecycle Replacement Plan for all assets included in the agency IT asset management program to IRMD at the same time the agency submits its biennial agency request budget document and in each subsequent biennial agency request budget documents thereafter. Newly purchased IT-related assets that are intended to be included in the Agency s ITAM Program must be tagged (with an agency or State of Oregon identification tag) prior to agency deployment of the IT asset in the agency s computing environment. (Note: If an agency utilizes agency specific asset tags, the agency shall ensure that the Agency number assigned by the DAS/State Controller s Division is added to the asset tag number/unique identifier (in the database field, spreadsheet cell, etc.) prior to sending/reporting the information to DAS/IRMD.) V. Existing IT-related assets meeting the definition of capital assets must be tagged with a State of Oregon identification tag and property control number, listed on the capital asset property inventory, and physically inventoried at least annually. Agencies will affix an agency or State of Oregon asset tag to all IT-related Capital assets by December 31, (Note: If an agency utilizes agency specific asset tags, the agency shall ensure that the Agency number assigned by the DAS/State Controller s Division is added to the asset tag number/unique identifier (in the database field, spreadsheet cell, etc.) prior to sending/reporting the information to DAS/IRMD.) VI. Agency management is responsible for establishing procedures to issue and inventory IT-related assets (capital and non-capital) assigned to employees. In addition to the required Capital Asset inventory, agencies shall maintain an inventory of all IT-related assets, typically classified as noncapital (e.g. Desk and Laptop computers, Cell phones, Personal Digital Assistants/palm pilots, software, etc.) assigned to state employees, contractors, and volunteers and will make such inventory available for audit. Note: The minimum types of IT assets to be included in the Agency ITAM program is identified in Attachment 2 to this policy, which will be updated periodically by DAS IRMD. Records of IT-related assets assigned to employees will be updated annually. The record will be used to document and assure that all property is returned to the State upon employee termination. 4

5 DAS Statewide Policy POLICY NAME: Information Technology Asset POLICY NUMBER: IRM Inventory/Management GUIDELINES (Continued): To assist with this task, agencies will affix an agency or State of Oregon identification tag to all ITrelated Non-Capital Assets by June 30, (Note: If an agency utilizes agency specific asset tags, the agency shall ensure that the Agency number assigned by the DAS/State Controller s Division is added to the asset tag number/unique identifier (in the database field, spreadsheet cell, etc.) prior to sending/reporting the information to DAS/IRMD.) VII. Agencies will collect and track, at minimum, the information required in Attachment 2, the Information Technology Asset Inventory Mandatory Attributes and report that information to DAS/IRMD according to a published state government-wide schedule. The required IT-Asset information (mandatory attributes) to be reported will be increased (or modified) over time. IT asset information detail required for an agency to efficiently and effectively manage its information technology operations (assets) is expected to exceed the level of detail required at the state government-wide level. VIII. Agencies will conduct a physical inventory to reconcile IT Asset Inventory information on-hand for all Capital Assets at least annually in compliance with the Oregon Accounting Manual requirements. Agencies will conduct a physical inventory to reconcile IT Asset Inventory information on-hand for all IT-related Capital and Non-Capital Assets, prior to the conclusion of each biennium. A physical inventory reconciliation report will be reported to DAS/IRMD according to a state government-wide published schedule. Discrepancies should be investigated. Documentation support that a physical inventory has been taken, for all locations, should be retained in the agency's central accounting office. IX. Agencies will ensure that appropriate software licensing agreements for software used by agency employees are in place and that the agency is in compliance with those agreements. X. Follow established agency policies & procedures for (or contact the DAS Information Resource Management Division (IRMD) for instructions on recommended practices for) deleting data from hard-drives prior to property transfer, exchange, or disposal/surplus. XI. Agencies will, prior to transferring, exchanging or disposing of an IT-related asset (according to the agency established lifecycle), review and follow the relevant DAS/State Controller s Division policies and the DAS Surplus Computer Equipment Disposal policy. ( ) 5

6 DAS Statewide Policy POLICY NAME: Information Technology Asset POLICY NUMBER: IRM Inventory/Management PROCEDURES: Step Responsible Party Action 1. Agency Head Establish an IT Asset Management Program and appoint an Agency IT Asset Inventory/Management (ITAM) Coordinator. Submit the ITAM Coordinator s name and contact information to DAS IRMD no later than thirty days from the effective date of this policy. 2. Agency Head or Agency ITAM Coordinator 3. Agency ITAM Coordinator Submit copies of Agency IT Asset Inventory/Management policies and procedures to DAS IRMD for review no later than ninety days from the effective date of this policy. Collect and report IT Asset Inventory/Management Information to DAS IRMD on a published state government-wide schedule (Attachment 5). 4. IRMD Analyst Review, consolidate, analyze and publish regular reports on State government-wide IT Asset Inventory/Management information. 5. Agency ITAM Coordinator 6. Agency Head or Agency ITAM Coordinator 7. Agency ITAM Coordinator Review the State government-wide IT Asset Inventory/ Management report published by DAS/IRMD for accuracy and notify DAS/IRMD of any discrepancies. Develop and submit a Lifecycle replacement plan to IRMD at the same time agency submits its biennial agency request budget document (Submission dates for each agency established as part of State Budget Instructions) Conduct a physical inventory of IT assets (Capital & Non-Capital on two different schedules), validate agency IT Asset Inventory/Management Information and create an annual IT Asset Inventory/Management reconciliation report for Agency Head certification. 8. Agency Head Certify that the agency is in compliance with software licensing agreements/requirements and that the IT Asset Inventory/Management reconciliation report is complete and accurate. 9. Agency Head or Agency ITAM Coordinator Submit validated & certified annual IT Asset Inventory/Management reconciliation report to DAS/IRMD. 6

7 DAS Statewide Policy POLICY NAME: Information Technology Asset POLICY NUMBER: IRM Inventory/Management Submit IT Asset Inventory/Management-related Information to IRMD Analyst at: Department of Administrative Services Information Resources Management Division Attn: Enterprise Planning and Policy 1225 Ferry Street SE Salem, OR Or by to: 7

8 Attachment 1: Information Technology Asset Management Glossary of Terms Term Definition Application: Application Server: Bridge: Browser: Cabling: CD-ROM: CDRW: Central Processing Unit (CPU): Client: Client-Server: Controller: Data: Database Management System (DBMS Database Server: Database: Desktop Computer: Embedded Technology: Enterprise Server: File Server: Firewall: Gateway: Groupware: Hardware: Hub: Information Technology (IT): IT Assets: A program or group of programs that perform specific task or functions. Hardware and software platforms dedicated to a specific type of application processing, groupware systems, custom business applications or mail service. A network device that connects two separate networks. Software which accesses and displays documents located on the Internet or the Intranet. The physical wire that connects components of a network. High-capacity read-only memory in the form of an optically read compact disk. High Capacity Read/Write memory in the form of an optically recorded compact disk. The part of a computer that includes the circuits that control the interpretation and execution of instructions. Also known as the processor or processing unit. A client is the requesting program or user in a client/server relationship. A computing model where functionality is divided between software clients and software servers. Clients depend on the services provided by servers such as another application, component, or database to complete the intended function. A device that coordinates and controls the operation of one or more input/output devices, and synchronizes the operation of such devices with the system as a whole. Factual information organized and used for transaction, analysis, and decision support. Software and data storage facility which organizes and manages data storage, structure, access, and security. Hardware and software platforms dedicated to database access. A collection of data with a given structure for accepting, storing, and providing, on demand, data. A computer designed to fit comfortably on top of a desk; two common types are the tower model and the table top model. Table top model computers are broad and low, tower model computers are narrow and tall. May also be referred to as a Personal Computer. Electronic mail messages in the form of text, documents, images, and other electronic files. Also known as Embedded Computers contain microprocessors that are designed into other products and equipment that are not themselves computers. Typically a large, scalable computer with multiple processors and client-server communications architecture. See Server One or more computer systems placed between trusted and non-trusted networks in order to prevent unauthorized access to networks and systems. Hardware or software that handles communication between two dissimilar protocols. Software that provides the infrastructure to work collaboratively and share information electronically, regardless of where they are geographically located. The physical, touchable, material parts of a computer or other system A hub joins multiple computers (or other network devices) together to form a single network segment. Includes, but is not limited to, all present and future forms of computer hardware, software and related services for data processing, office automation, and telecommunications but does not include Embedded Technologies. Include, but are not limited to, all present and future forms of computer hardware, software and related items used for business data processing and office automation but does not include devices with Embedded Technology. 1

9 Attachment 1: Information Technology Asset Management Glossary of Terms IT Asset Disposal: IT Asset Inventory: IT Asset Management: IT Asset Repository: A process that ensures that assets are disposed of systematically, timely and accurately to ensure proper accountability. The process of discovering and verifying information about an organization s information technology asset (e.g. hardware, software, applications, data, etc.) through manual and/or automated means A system of integrated management processes, strategies and technologies that enables an enterprise to manage its assets throughout their lifecycle. A repository which contains information on the physical, financial and contract information associated with an organization s IT assets. IT Asset Retirement: IT Asset Tracking: IT Auto-Discovery: Intranet: Laptop: Lifecycle: Lifecycle Management: The physical data may include information about inventory management, version control, software distribution, license tracking, usage monitoring and retirement. The financial component may cover procurement, budget, cost and charge-backs. The contractual component may cover license compliance, contract maintenance, supplier management. The process of identifying and removing dormant assets from the IT environment that accrue costs without providing benefits. Once IT asset data is obtained through auto-discovery and/or a physical inventory, asset tracking involves the process of recording all future installs, moves, adds and changes to ensure that the asset repository remains accurate and up to date. The process by which tools/programs find and inventory IT Assets that are connected to the network. A web site or group of web sites. A small, portable computer sometimes referred to as a notebook computer, typically with display unit built in small enough that it can sit on your lap. The series of stages in form and functional activity through which something passes during its lifetime. Typically IT asset lifecycle involves at least four stages: Acquisition, Deployment, Management/Support, retirement. The practice of managing an organization s IT assets through the lifecycle of Acquisition, Deployment, Management/Support, Retirement Local Area Network (LAN): A geographically limited communication network that connects users within a defined area. Mainframe: Metropolitan Area Network (MAN): Midrange: Monitor: Network: Network Operating System (NOS): Operating System (OS): Personal Digital Assistant (PDA): Peripheral: Personal Computer (PC): Physical Inventory: A powerful computer, used in a multipurpose environment at the corporate or major divisional level. A mainframe is a large-scale computer typically containing a large quantity of main memory and disk storage and is able to support thousands of simultaneous users. A data network designed for a town or city. In terms of geographic breadth, MANs are larger than local-area networks (LANs), but smaller than wide-area networks (WANs). A large computer, smaller than a mainframe with communications architecture like a mainframe but which is substantially smaller in computing capacity. A monitor is a computer output surface and projecting mechanism that shows text and often graphic images to the computer user, using a cathode ray tube (CRT), liquid crystal display (LCD), light-emitting diode, gas plasma, or other image projection technology. May also be referred to as a display. A collection of computers and other computer related devices that are able to communicate with each other over some transmission media. Software that is used to link files, computers, and other devices over a LAN or WAN. Software that performs basic functions on a platform, such as accepting input from the keyboard, sending output to a screen, managing files and directories on disks, and controlling other devices such as printers. A handheld device that combines computing, telephone/fax, Internet, networking and other features A type of computer hardware that is added to the computer, in order to expand its abilities. More specifically the term is used to describe those devices that are optional in nature, as opposed to hardware that is either demanded, or always required in principle. A laptop or desktop computer plus components such as a monitor, keyboard, mouse, modem and other parts. A personal computer may be connected to a local are network or be a standalone workstation. The verification of existence and location of an asset by physical or electronic means. 2

10 Attachment 1: Information Technology Asset Management Glossary of Terms Printer: Print Server: Router: Security: Server: Service Level Agreement (SLA): Software Distribution: Software Management Tools: Software: Thin Client: Total of Ownership: Vendor: Version Control: Web: Website: Wide Area Network (WAN): A device which takes computer information and prints it on paper. Hardware and software that manages shared printers on a network. The combination of hardware and software that links LANs and WANs together. Measures and controls that ensure confidentiality, integrity, and availability of information system (IS) assets including hardware, software, firmware, and information being processed, stored and communicated. The application of hardware, firmware and software security features to a computer system in order to protect against, or prevent, the unauthorized disclosure, manipulation, deletion of information or denial of service. A computer in a network that is used to provide services to other computers in the network. Such as, access to files, shared peripherals (e.g. printers), the internet (web services), application, data/databases, the routing of . Also a computer program that provides services to other computer programs in the same or on other computers. An agreement among two or more parties that establishes measurable levels of service and expectations for that service. The process of propagating software installation, upgrades, and maintenance to each workstation that needs it. Tools which provide version control, configuration management, and software distribution services. The detailed instructions given to operate a personal computer, mainframe or server. A two-tier client/server model for application design in which most of the computer code is executed on a server and the client process is limited to the software that provides the user presentation only. A type of calculation designed to help consumers and enterprise managers assess both direct and indirect costs and benefits related to the purchase of any IT asset. The provider of goods or services. The process of controlling, maintaining, and documenting maintenance and updates to computer software programs. An abbreviation for the Internet s World Wide Web. The World Wide Web is the universe of accessible information available on many computers spread through the world and attached to the Internet. Any machine on the internet that is running a Web Server to respond to requests from remote web browsers is a Web Site. Provides connectivity services across a large geographical area. A wide area network includes communications lines and equipment up to and including the router at a particular end user site, excluding local area networks (LANs). 3

11 Attachment 2: Information Technology Asset Inventory Mandatory Attributes Asset Agency Minimum Attribute Tracking Requirements Type Physical Financial Examples Type: Desktop/Laptop/Thin Client Device CPU Life/Theft/Loss/Damage Personal Computer (PC) Printer/ Plotters Network Router Type: Inkjet/Laserjet/Impact Life/Theft/Loss/Damage Life/ Theft/Loss/Damage Unique #:A Type: Desktop : Dell : GX270 : Optiplex Desktop CPU : 2.8 Ghz Asset Tag#: D51453 Type: Laserjet : HP : 1150 : Monochrome Asset Tag# : A : Cisco : 1720 : 10/100 Network Switch Life/ Theft/Loss/Damage Asset Tag#: A : Cisco : 6509 : 9 slot Catalyst Network Hub (CAU/ LAM) Life/ Theft/Loss/Damage Asset Tag #: E03280 : Cisco :1538 : 8 Port Stackable 10/100 Microhub 1

12 Attachment 2: Information Technology Asset Inventory Mandatory Attributes Asset Agency Minimum Attribute Tracking Requirements Type Physical Financial Examples Network Bridge (Wired/Wireless) Life/ Theft/Loss/Damage Asset Tag# : : Cisco : 1400 : Aironet Wireless Bridge Network Gateway Mainframe Mainframe Controllers Life/ Theft/Loss/Damage Life/ Theft/Loss/Damage Life/ Theft/Loss/Damage Asset Tag#: : Cisco :AS5350 : Universal Gateway Asset Tag#: : IBM : (Z800) : CPU Asset Tag#: : IBM : 3174 : Controller Mainframe Tape Storage Capacity Life/Theft/Loss/Damage Asset Tag#: : IBM : 3490 : Cartrige Tape Drive Capacity:180GB (cache) 2

13 Attachment 2: Information Technology Asset Inventory Mandatory Attributes Asset Agency Minimum Attribute Tracking Requirements Type Physical Financial Examples Asset Tag#: : Hitachi : 7700E : DASD Capacity: 1.66 TB Capacity Life/Theft/Loss/ Damage Mainframe Disk Storage Server Asset Tag # or unique identifier Type: File/Print/Web/ Database/ Firewall/ / Application : Life/Theft/Loss/Damage Asset Tag#: A Type: Application : Dell : 2650 : PowerEdge 3

14 Attachment 3: Information Technology Asset Management-Related Architecture and Standards Document Emerging Concept Oregon State government is just beginning its Statewide Technical Architecture development effort. A decision has been made to adopt the architecture format developed by the National Association of State Chief Information Officers (NASCIO) through its Adaptive Enterprise Architecture Development Program. Initiatives are underway to develop architecture in several domain areas with more efforts on the horizon. Previously, the State of Oregon used a format called the Oregon Information Technology Standards Directory. The directory recorded information technology standards in use throughout state government. It did not attempt to describe the overarching precepts and business conclusions drawn out by the NASCIO model. Sponsorship and Participation Oregon s Statewide Technical Architecture is being developed jointly by the State Chief Information Officer and the state s Chief Information Officer Council (CIOC). The CIOC is comprised of Chief Information Officers from many of the state s agencies. Under direction of the CIOC, various Domain Teams comprised of subject matter experts from across Oregon State government are collaboratively developing architecture subject areas. Objective The architecture is a repository for a consistent set of guidelines (concepts, principles, policies, methodologies, interfaces, performance expectations and standards) for use in designing information technology infrastructure and systems. The architecture is intended to reduce costs, improve the availability and performance of applications, allow interoperability, improve the ability to share data, and reduce staff training needs. The IT Asset Management-Related Architecture and Standards document is available at: 1

15 Attachment 4: Minimum Information Technology Asset Management Performance Standards Minimum Information Technology Asset Management Performance Standards are those business actions required to assure the efficiency and effectiveness of state government operations and establish an essential level of management responsibility and accountability for acquiring, deploying, tracking/managing, and disposing of IT-related assets under agency control. To fulfill Agency obligations under this Statewide IT Asset Management Policy, Agencies will, at minimum: Comply with this Statewide IT Asset Inventory/Management Policy Reference the creation of a formal IT Asset Management Program within the agency and identify an Agency ITAM Coordinator in all agency IT asset inventory/management-related process and procedure documents Create, document and communicate IT Asset Inventory/Management processes/procedures that provide sufficient guidance for agency staff to understand their respective IT Asset Management Program roles, responsibilities, and obligations to the Agency and to DAS/IRMD. Create and document standard lifecycles for agency IT assets (PC s, Servers, Mainframes, etc.) and mandate the creation of an agency PC Lifecycle replacement plan to be submitted to IRMD at the same time the agency submits its biennial agency request budget document. Create and document process/procedure (manual and automated) agency intends to use to collect, track, and report, at minimum, the information required in Attachment 2, the Information Technology Asset Inventory Mandatory Attributes. Note: IT asset information detail required for an agency to efficiently and effectively manage its information technology operations (assets) is expected to exceed the level of detail required at the state government-wide level. Create and document process/procedure agency intends to use to affix an agency or State of Oregon identification tag to: newly purchased IT-related assets (Tagging required prior to deployment in the computing environment) existing capital assets (Tagging required by December 31, Also requires the issuance and use of a property control number) existing non-capital assets (Tagging required by June 30, 2005.) (Note: If an agency utilizes agency specific asset tags, the agency tag numbers must begin with the Agency number assigned by the DAS/State Controller s Division.) Create and document process/procedure agency intends to use to physically inventory and reconcile IT asset inventory information on hand for: Capital Assets (Inventory must be conducted at least annually in compliance with the Oregon Accounting Manual Requirements. Use of property control number is also required.) Non-Capital Assets (Inventory required prior to the conclusion of each biennium per this Statewide IT Asset Management Policy). 1

16 Attachment 4: Minimum Information Technology Asset Management Performance Standards Note: A physical inventory reconciliation report must be reported to DAS/IRMD according to Attachment 5. Discrepancies should be investigated. Documentation support that a physical inventory has been taken, for all locations, should be retained in the agency's central accounting office. Create and document process/procedure agency intends to use to issue IT-related assets (capital and non-capital) to employees, to inventory and update these records on an annual basis, and to review these records to assure that all property is returned to the State upon employee termination or transfer out of the agency. (Note: The minimum IT asset types to be included in the Agency ITAM program is identified in Attachment 2 to this policy, which will be updated periodically by DAS IRMD.) Create and document the process/procedure agency intends to use to ensure that appropriate software licensing agreements for software used by agency employees are in place and that the agency is in compliance with those agreements. Create and document the process/procedure agency intends to use for deleting data from harddrives prior to property transfer, exchange, or disposal/surplus. Create and document the process/procedure the agency intends to use transfer, exchange or dispose of an IT-related asset (according to the agency established lifecycle). 2

17 Attachment 5: State Government-wide IT Asset Inventory Submission Schedule Submission Schedule: May 14, Agency ITAM Coordinator name and contact information June 30, Initial inventory report and copies of Agency IT Asset Inventory/Management policies and procedures. October 29, 2004 Inventory report December 31, 2004 Inventory report, Agency software licensure compliance certification, and confirmation that all IT-related agency capital assets have been tagged. March 31, 2005 Inventory report June 30, 2005 Inventory report, validate and certified physical inventory reconciliation report, and confirmation that all IT-related agency non-capital assets have been tagged. Submit IT Asset Inventory/Management-related Information to IRMD Analyst at: Department of Administrative Services Information Resources Management Division Attn: Enterprise Planning and Policy 1225 Ferry Street SE Salem, OR Or by to: mailto:sean.l.mcspaden@das.state.or.us 1